Read the docs
TI-2024-36053 Aliases CVE-2024-53860GHSA-mj5r-x73q-fjw6

Potential Abuse for Sending Arbitrary Emails in sp-php-email-handler

Priority MEDIUM 44CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

sp-php-email-handler is a PHP package for handling contact form submissions. Messages sent using this script are vulnerable to abuse, as the script allows anybody to specify arbitrary email recipients and include user-provided content in confirmation emails. This could enable malicious actors to use your server to send spam, phishing emails, or other malicious content, potentially damaging your domain's reputation and leading to blacklisting by email providers. Patched in version 1.0.0 by removing user-provided content from confirmation emails. All pre-release versions (alpha and beta) are vulnerable to this issue and should not be used. There are no workarounds for this issue. Users must upgrade to version 1.0.0 to mitigate the vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00464 40th percentileScored 2026-11-07
Fix Fixed SPEmailHandler-PHP (Spencer14420): 1.0.0spencer14420/sp-php-email-handler (Packagist): 1.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Spencer14420SPEmailHandler-PHPbefore 1.0.01.0.0Patch availableCNA
—spencer14420/sp-php-email-handler (Packagist)before 1.0.01.0.0Patch availableGHSA-mj5r-x73q-fjw6
  • SPEmailHandler-PHP VendorSpencer14420 Affected before 1.0.0 Fixed in 1.0.0 Patch available CNA
  • spencer14420/sp-php-email-handler (Packagist) Vendor— Affected before 1.0.0 Fixed in 1.0.0 Patch available GHSA-mj5r-x73q-fjw6

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:spencer14420:spemailhandler-php:*:*:*:*:*:*:*:*——Spencer14420
  • cpe:2.3:a:spencer14420:spemailhandler-php:*:*:*:*:*:*:*:* Versions — — ·Spencer14420

Remediation

  • Fix · CNA SPEmailHandler-PHP (Spencer14420) Fixed in 1.0.0
  • Fix · GHSA-mj5r-x73q-fjw6 spencer14420/sp-php-email-handler (Packagist) Fixed in 1.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-53860
  2. 2026-10-03 Alias added: GHSA-mj5r-x73q-fjw6

References

Advisory 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences